sneak
47cab048a5
check / check (push) In progress
Every setting of discriminator and rproxy is read through viper, in place of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and AllowEmptyEnv on, so a setting that is set but empty reads as set. A setting may also be given as a file, the _FILE form, which rproxy's settings now have too; rproxy still writes nothing to disk. The settings are renamed. Discriminator's take the prefix SWW_WAF_, rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_. Model: deepseek-v4-pro (first version); opus-5-5 (rework)
49 lines
1.5 KiB
Go
49 lines
1.5 KiB
Go
package discriminator
|
|
|
|
// What the reputation heuristics share: blocklists, crowdsec, dnsbl and
|
|
// abuseipdb.
|
|
|
|
import (
|
|
"sneak.berlin/go/smallwebwaf/internal/alerts"
|
|
"sneak.berlin/go/smallwebwaf/internal/bans"
|
|
)
|
|
|
|
// deny is the SWW_WAF_BLOCKLIST_ACTION and the SWW_WAF_REPUTATION_ACTION that
|
|
// refuses the requests of a client a source lists.
|
|
const deny = "deny"
|
|
|
|
// noteListed notes each of sources, the URLs of the blocklists or the
|
|
// DNSBL zones, their keys masked, that list the client, as noteHit does,
|
|
// with reason.
|
|
func (rq *request) noteListed(sources []string, reason string) {
|
|
for _, source := range sources {
|
|
rq.noteHit(bans.ReputationHit{Source: source}, reason)
|
|
}
|
|
}
|
|
|
|
// noteHit adds hit's source, which lists the client, to the log line's
|
|
// reputation, and hit to the notes of a ban the request makes, counts the
|
|
// source in the metrics, and raises a reputation_hit alert with reason,
|
|
// whose detail gives hit's source and score.
|
|
func (rq *request) noteHit(hit bans.ReputationHit, reason string) {
|
|
detail := map[string]any{"source": hit.Source}
|
|
if hit.Score != nil {
|
|
detail["score"] = *hit.Score
|
|
}
|
|
|
|
rq.line.Reputation = append(rq.line.Reputation, hit.Source)
|
|
rq.reputation = append(rq.reputation, hit)
|
|
rq.h.metrics.ReputationHit(hit.Source)
|
|
rq.h.alerts.Raise(alerts.Alert{
|
|
Event: alerts.EventReputationHit,
|
|
Host: rq.site,
|
|
Client: rq.client,
|
|
Netblock: rq.h.clientGroup(rq.client),
|
|
ASN: rq.line.ASN,
|
|
ASName: rq.line.ASName,
|
|
Country: rq.line.Country,
|
|
Reason: reason,
|
|
Detail: detail,
|
|
})
|
|
}
|